database/mariadb-connector-c
1
0
Fork 0
mirror of https://github.com/mariadb-corporation/mariadb-connector-c.git synced 2025-07-30 19:03:17 +03:00
Code Activity

CONC-748: Allow to set TLSv1.3 ciphers in GnuTLS

Browse Source 
- Added TLSv1.3 ciphers to cipher map.
- Fixed retrieval of cipher suite: Since gnutls_cipher_suite_get_name
  supports only TLSv1.2 (and lower) cipher suites, we have to call
  gnutls_ciphersuite_get() (requires GnuTLS 3.7.4 or newer).
This commit is contained in:
Georg Richter
2024-12-08 11:27:32 +01:00
parent 232e81f021
commit af44fc5c5e
2 changed files with 90 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

59
libmariadb/secure/gnutls.c
View File

@ -723,6 +723,26 @@ const struct st_cipher_map tls_ciphers[]=
"TLS_DH_anon_WITH_AES_256_GCM_SHA384",
NULL,
"TLS_DH_ANON_AES_256_GCM_SHA384"},
{ {0x13, 0x01},
"TLS_AES_128_GCM_SHA256",
"TLS_AES_128_GCM_SHA256",
"TLS_AES_128_GCM_SHA256"},
{ {0x13, 0x02},
"TLS_AES_256_GCM_SHA384",
"TLS_AES_256_GCM_SHA384",
"TLS_AES_256_GCM_SHA384"},
{ {0x13, 0x03},
"TLS_CHACHA20_POLY1305_SHA256",
"TLS_CHACHA20_POLY1305_SHA256",
"TLS_CHACHA20_POLY1305_SHA256"},
{ {0x13, 0x04},
"TLS_AES_128_CCM_SHA256",
"TLS_AES_128_CCM_SHA256",
"TLS_AES_128_CCM_SHA256"},
{ {0x13, 0x05},
"TLS_AES_128_CCM_8_SHA256",
"TLS_AES_128_CCM_8_SHA256",
"TLS_AES_128_CCM_8_SHA256"},
{ {0xC0, 0x84},
"TLS_DH_anon_WITH_CAMELLIA_128_GCM_SHA256",
NULL,
@ -793,6 +813,7 @@ const struct st_cipher_map tls_ciphers[]=
NULL}
};
#if GNUTLS_VERSION_NUMBER < 0x030704
/* map the gnutls cipher suite (defined by key exchange algorithm, cipher
and mac algorithm) to the corresponding OpenSSL cipher name */
static const char *openssl_cipher_name(gnutls_kx_algorithm_t kx,
@ -829,6 +850,7 @@ static const char *openssl_cipher_name(gnutls_kx_algorithm_t kx,
}
return NULL;
}
#endif
/* get priority string for a given openssl cipher name */
static char *get_priority(const char *cipher_name, char *priority, size_t len)
@ -857,10 +879,20 @@ static char *get_priority(const char *cipher_name, char *priority, size_t len)
{
if (!strcmp(name, tls_ciphers[i].gnutls_name))
{
snprintf(priority, len - 1, ":+%s:+%s:+%s",
gnutls_cipher_get_name(cipher),
gnutls_mac_get_name(mac),
gnutls_kx_get_name(kx));
const char *p;
if ((p= gnutls_cipher_get_name(cipher)))
snprintf(priority, len - 1, ":+%s",p);
if ((p= gnutls_mac_get_name(mac)))
{
strncat(priority, ":+", len - 1);
strncat(priority, p, len - 1);
}
if ((p= gnutls_kx_get_name(kx)))
{
strncat(priority, ":+", len - 1);
strncat(priority, p, len - 1);
}
return priority;
}
}
@ -1329,6 +1361,7 @@ int ma_tls_verify_server_cert(MARIADB_TLS *ctls __attribute__((unused)))
const char *ma_tls_get_cipher(MARIADB_TLS *ctls)
{
#if GNUTLS_VERSION_NUMBER < 0x030704
gnutls_kx_algorithm_t kx;
gnutls_cipher_algorithm_t cipher;
gnutls_mac_algorithm_t mac;
@ -1340,6 +1373,24 @@ const char *ma_tls_get_cipher(MARIADB_TLS *ctls)
cipher= gnutls_cipher_get((gnutls_session_t)ctls->ssl);
kx= gnutls_kx_get((gnutls_session_t)ctls->ssl);
return openssl_cipher_name(kx, cipher, mac);
#else
const char *cs= gnutls_ciphersuite_get((gnutls_session_t)ctls->ssl);
int i=0;
while (tls_ciphers[i].iana_name)
{
if (!strcmp(tls_ciphers[i].gnutls_name, cs))
{
if (tls_ciphers[i].openssl_name)
return tls_ciphers[i].openssl_name;
if (tls_ciphers[i].gnutls_name)
return tls_ciphers[i].gnutls_name;
return tls_ciphers[i].iana_name;
}
i++;
}
return NULL;
#endif
}
static int my_verify_callback(gnutls_session_t ssl)